| 1 |
# What astra's ROLE needs, as opposed to which dials its mint sets. |
| 2 |
# |
| 3 |
# See build/hosts/fw13.requires for why this file exists at all: the recipes say |
| 4 |
# what goes in, this says what has to come out, and on 2026-09-04 every dial was |
| 5 |
# correct while the image still could not build a Tauri app or restore a prod |
| 6 |
# dump. Checked by build/preflight.sh. |
| 7 |
# |
| 8 |
# astra is the aarch64 half of the same two roles fw13 plays, plus the evidence |
| 9 |
# tier. It is a server profile, so nothing here may assume a graphical session. |
| 10 |
|
| 11 |
# --- Bento's arm64 builder: the tree's crates, and the Tauri apps |
| 12 |
bin:cargo |
| 13 |
bin:rustc |
| 14 |
bin:gcc |
| 15 |
bin:git |
| 16 |
pkgconfig:webkit2gtk-4.1 |
| 17 |
pkgconfig:gtk+-3.0 |
| 18 |
pkgconfig:libsoup-3.0 |
| 19 |
pkgconfig:librsvg-2.0 |
| 20 |
pkgconfig:openssl |
| 21 |
|
| 22 |
# --- Go, blessed 2026-09-07 for Make Creative software where it is warranted. |
| 23 |
# Asserted before anything in the tree is Go, deliberately: a blessing that the |
| 24 |
# build hosts cannot honour is one somebody discovers at the wrong moment. |
| 25 |
bin:go |
| 26 |
|
| 27 |
# --- the frontends Sando's code_smoke gate compiles |
| 28 |
bin:node |
| 29 |
bin:npm |
| 30 |
|
| 31 |
# --- PoM's runner and Sando's gates restore production dumps here too. |
| 32 |
# The extensions are not optional: a restore stops at the first CREATE EXTENSION |
| 33 |
# it cannot satisfy, which is what cost rehearsal 3 a build on 2026-09-04. |
| 34 |
bin:psql |
| 35 |
bin:postgres |
| 36 |
bin:initdb |
| 37 |
file:*/pgcrypto.control |
| 38 |
file:*/pg_trgm.control |
| 39 |
|
| 40 |
# --- the fleet control plane. ops-exec spawns rsync by name, so a machine |
| 41 |
# without it cannot collect a build from another host or hand a release over. |
| 42 |
bin:rsync |
| 43 |
bin:ssh |
| 44 |
|
| 45 |
# --- release signing. Same as fw13: dist/sign-artifacts.sh hard-fails without |
| 46 |
# minisign, and an arm64 release is signed on the host that built it. |
| 47 |
bin:minisign |
| 48 |
|
| 49 |
# --- secrets. _private keeps its .env-shaped files under sops and its opaque |
| 50 |
# blobs, minisign's own signing key included, as whole-file .age. Without the |
| 51 |
# binary a machine holds ciphertext it cannot open, and nothing says so until |
| 52 |
# somebody needs a key. The identity itself is copied by hand and stays out of |
| 53 |
# the image. |
| 54 |
bin:age |
| 55 |
|